Method and apparatus for using histograms to produce data summaries

ABSTRACT

A system and method are provided for monitoring dynamic data from distributed sources through the use of histograms. In the method, an array sketch of the digital signal is determined, a robust histogram is constructed from the array sketch, and an output histogram is constructed from the array sketch and the robust histogram via a hybrid histogram. Dyadic intervals of a representation of the array sketch are used in constructing the robust histogram.

CROSS-REFERENCES TO RELATED APPLICATIONS

This application claims priority to Provisional Application Ser. No. 60/281,202 filed Apr. 3, 2001 entitled Surfing Wavelets on Streams: One-Pass Summaries for Approximate Aggregate Queries; and is related to U.S. patent application Ser. No. 10/114,136 filed Apr. 2, 2002 entitled Method and Apparatus for Using Wavelets for Producing Data Summaries.

FIELD OF THE INVENTION

This invention relates generally to the use of histograms to provide data synopses. More particularly, this invention relates to generating histograms from dynamic and distributed data sources to summarize data in a small amount of time and space.

BACKGROUND OF THE INVENTION

In various industries, it is increasingly important to obtain representative data, summarize data and/or to determine data trends. This often must be done given the constraints of the existing physical structure of the particular system that generates or receives the data of interest. In addition, this often must be done in a relatively fast amount of time and without burdening the system with respect to memory, processing power, or the like. For example, in the telecommunications industry, it might be of interest to obtain data on call traffic through an area of the network to observe load. However, in doing so, it is important not to usurp the network of its memory and processing abilities for routing call traffic.

There are several tools that can be used to obtain the desired data output. For example, histograms are succinct and space-efficient approximations of distributions of numerical values. Histograms are among the simplest class of data representations. They are easy to visualize and implement statistical analyses. Histograms find many applications in computer systems. For example, most commercial database engines keep a histogram of the various value distributions in a database for optimizing query executions and for approximately processing queries, image processing systems handle color histograms, etc.

In addition to histograms, wavelets can also be used to obtain a desired data synopsis. Wavelets are mathematical functions that divide data into different frequencies and enable the study or manipulation of each frequency component with a particular resolution. Wavelets are used in a variety of applications including image compression, turbulence, human vision, radar, and earth quake prediction.

Histogram and wavelet approximations are compact, i.e., they do not consume a significant amount of memory or processing energy. Although the data representations provided by histograms and wavelets are not exact representations, the data representation is sufficient for most trend analysis.

The present application may be implemented in connection with distributed and dynamic data sources associated with large scale networks. For example, network routers generate a data stream of logs of the traffic that flows through the network. In order to conduct real time traffic control, network operators must know traffic patterns at various routers at any given moment. However, it is prohibitively bandwidth-expensive to transfer data streams of traffic logs from routers to central monitoring stations on a continuous basis. Compact data representations are less bandwidth-expensive.

Space-efficient data representations are also needed in other areas such as the financial industry. Stock transactions continually occur throughout the day and each transaction changes the underlying data distribution. In other words, the volume of shares sold per stock can fluctuate every minute. These transactions are stored in databases in a variety of locations. There is a need to maintain data representations in real time in transactional databases given these rapid data changes.

Prior histogram work has not been able to handle both the positive and negative data updates to perform certain types of distributed data calculations.

Given the foregoing, there is a need in the industry to provide real-time data from distributed databases in a manner that consumes a feasible amount of bandwidth, memory, and processing power, in an accurate and timely manner. This need is especially great where for dynamic data distributions, i.e., where the data changes rapidly.

BRIEF SUMMARY OF THE INVENTION

Limitations of the prior art are overcome and a technical advance is made in accordance with the present invention, illustrative embodiments of which are described below.

In accordance with aspects of one illustrative embodiment of the present invention, a method is provided for outputting a B-bucket histogram that corresponds to a data signal, A, of length N. The number of buckets, B, in the histogram is significantly less than the length of the signal, N. The method includes the steps of receiving the data signal, determining an array sketch of the data signal, and constructing a robust histogram from the array sketch. This constructing step comprises identifying resolution levels of dyadic intervals of a representation of the array sketch, identifying a single dyadic interval that decreases the differences between the representation and the robust histogram, and iterating the identification of a single dyadic interval step with subsequent dyadic intervals until the representation is substantially equivalent to the robust histogram. In addition, the method includes constructing an output histogram from the array sketch and the robust histogram via a hybrid histogram.

In accordance with other illustrative aspects of the present invention, a method is provided for summarizing dynamic data from distributed sources through the use of histograms. In particular, the method comprises receiving a first data signal at a first location, where the first data signal is dynamic and determining a first array sketch of the first data signal. The method further comprises receiving a second data signal at a second location, where the second data signal is dynamic and determining a second array sketch of the second data signal. First and second array sketches are sent to a third location desiring data summaries where an output histogram for a linear combination of the two data signals is generated.

In one embodiment, the method further comprises obtaining first and second array sketches from first and second locations respectively, and constructing an output histogram of a linear combination of the first and second array sketches.

BRIEF DESCRIPTION OF THE DRAWING

The present invention will be more fully understood by reading the following detailed description in conjunction with the drawing, in which:

FIG. 1 is a diagram illustrating a network in which the present invention may be illustrated;

FIG. 2 a is a representation of an exemplary stream of data transactions to be summarized by the present invention;

FIG. 2 b is a representation of the aggregated stream, which yields data signal, A;

FIG. 3 a is a graphical representation of the data signal A of FIG. 2 b with a robust histogram overlay;

FIG. 3 b is a graphical representation of data signal A with a one-bucket output histogram overlay; and

FIG. 4 is a portion of the network of FIG. 1 showing the operation of a synopsis data structure for generating wavelets in accordance with an exemplary embodiment of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

In general, the present invention includes both a data (array) sketching method and a reconstruction method. The array sketch of a data signal can be produced at a router, or other suitable device receiving raw data, or by multiple devices simultaneously. The reconstruction of the array sketch includes the use of wavelets or histograms to achieve representations of the sketches. The reconstruction can take place at a router, a device receiving raw data and creating the array sketch, a data warehouse or other location where data summaries are of interest.

For illustrative purposes, the data used herein to discuss the present invention is information about the traffic, e.g., source and destination addresses, routed through a network such as the Internet. Traffic originates at addresses, such as IP addresses, and travels in packets to routers through a network to respective destination addresses. The data is dynamic in that new traffic is constantly generated and new packets are constantly being sent (or not being sent where they once were). In addition, there are routers distributed throughout the network. In order to obtain a statistical summary of the data, the method of the present invention accommodates the dynamic and distributed nature of the data. It will be appreciated that the present invention is applicable to other data environments where data summaries are desired.

FIG. 1 is a diagram of a system illustrating an embodiment in which the present inventive method may be implemented. Network 100 includes routers 102, 112, and 122 as exemplary routers. Routers 102, 112, and 122 route data packets through network 130. Connected to each of routers 102, 112, and 122 are various devices that represent potential origination (and destination) addresses from which raw data will originate and be transmitted through the appropriate router and then through Internet 130. These devices include web server 118, computers 104, 114, 116, and 124, and IP telephones 106, 126, and 128. It will be obvious to one of ordinary skill in the art that many other devices, now known or later discovered, whether individually connected or over a LAN, can also be suitable devices to transmit data through a network, via a wired or wireless connection.

Within each router 102, 112, and 122, is shown a synopsis data structure (SDS). In accordance with one embodiment of the present invention, each SDS receives and stores raw data and builds array sketches from the data, discussed below, for subsequent histogram or wavelet reconstruction, either within the router or by some other device at that or another location. By building the sketches at the routers, the distribution cost of transmitting raw data is saved.

More specifically, the SDS is defined to be of a small space and to support all necessary computations in a small time. In this case, small means a value of at most polynomial in B, log N, and 1/ε. The term B is the number of buckets for a histogram, or, for wavelets, the number of wavelet terms in a the representation. The term N is the length of the data array. The term ε is a low-value, user-defined parameter. For histograms, the SDS updates the arrays as new data is received, identifies dyadic intervals with large projections, estimates the best parameters to store in each interval, and estimates norms. A dyadic interval is of the form [i2^(j), . . . , (i+1)2^(j)), for integers i and j, as is known in the art.

An aspect of the present invention uses the SDS by repeatedly adding to a partial histogram, the dyadic interval that reduces the error of approximation the most. This repetition is continued until a stable representation of the data signal is achieved with poly (B, log N, 1/ε) buckets. Within the present application, this stable representation is referred to as a robust approximation of the signal. The robust approximation reflects the fact that the possible information has been extracted from the original data signal in a B-bucket approximation. The robust approximation, H_(r), is then used to produce a B-bucket approximation H.

In the wavelet arena, the SDS updates the arrays as new data is received, identifies the wavelet coefficients with large absolute value, estimates those large coefficients and estimates norms. The present invention produces a B-term wavelet representation from a given array, that minimizes the representation error.

Data Array Sketches

Within the present application, the following notation is used. A is a vector (or signal) of length N. (In other words, A=a[0], a[1], a[2], . . . , a[N−1].) For an interval I⊂[0, N), π(A, I) denotes the projection of the vector A on interval I. In other words, π(A, I) equals A on I and zero elsewhere. The vector χ_(I) equals 1 on I and zero elsewhere.

The data about packets traveling through a network can be grouped and thought of as an array of data. An array sketch is a data structure for a dynamic array A that supports generalized updates to A and several fundamental queries about A. The data structure is parameterized by ε_(s), η, and N, where ε_(s) and η, are user defined parameters and N is the length of the data array. For array sketches, small is defined as a value of at most polynomial in log (N), 1/η, and 1/ε_(s). “Compact” means a small size and “quickly” means using a small amount of time.

A (ε_(s), η, N)—array sketch of a signal A, is a compact synopsis data structure that represents an array of length N and quickly supports the following operations: update, identification and estimation. The update operation means that given a number c and an interval I, an array sketch can be computed for A+c_(χ) _(I). The identification means that a list of all dyadic intervals I can be identified such that ∥A−c^(I) _(opt)χ_(I)∥≦(1−η)∥A∥ but contains no interval I such that ∥A−c^(I) _(opt)χ_(I)∥>(1−η/2)∥A∥ With regard to the estimation characteristics, the array sketch can estimate both norms and parameters. In estimating norms, ∥A∥_(s) can be obtained such that ∥A∥≦A∥_(s)≦(1+ε_(s))∥A∥. In estimating parameters, given an interval I, a value c can be obtained such that ∥A−cχ_(I)∥≦(1+ε_(s))∥A−c^(I) _(opt)χ_(I)∥.

In general, given a data signal A, interval I and number c are determined such that ∥A−cχ_(I)∥ is significantly less than ∥A∥. The signal A is then updated with A−cχ_(I).

Histograms

Histograms are general piecewise-constant approximation of data distributions. For example, suppose A is a function, distribution, signal or the like of N points given by A [0 . . . N). A B-bucket histogram H of A is defined by a partition of the domain [0 . . . N) into B buckets (intervals) B_(i), as well as by B parameters b_(i). For any x∈[0 . . . N), the value of H(x) is equal to the b_(i) term, such that x∈B_(i). Since B is typically much smaller than N, this is a lossy representation. The quantity ∥A−H∥_(p), where ∥ ∥_(p) is the l_(p) norm, is the error in approximating A by a B-bucket histogram H. Typically, the norms of interest are l₁, average absolute value error, or l₂, root means square error.

The basic problem is to identify a sufficient histogram for a given data structure and optimize the histogram. In other words, it is desirable to minimize ∥A−H∥₁, or ∥A−H∥₂. It is a special case where the data inputs include dynamic data, i.e., data that is constantly changing or updating, and where the data sources are distributed, e.g., throughout a network. Histograms for single static data streams can be determined in a straightforward way as is known in the art, but permits for no data updates. However, histograms of dynamic distributed data streams prove to be a more difficult problem.

A B-bucket histogram H can be obtained given the robust approximation H_(r). In an exemplary embodiment, dynamic programming can be used to construct optimal histograms. However, this assumes knowledge of the exact or approximate value of the error of a histogram when projected on a subinterval. In a sketch setting, this is not possible because the sketch is constructed for the entire interval. The sketch may suggest subintervals with large projection but cannot evaluate norms projected to subintervals. When this is the case, a technique of creating a set of histograms within a given interval may be used. This permits the addition of “subintervals” and circumvents the necessity of knowing projections.

More specifically, a suitable histogram H of data signal A can be computed as follows.

-   1. Create a sketch of the data signal. -   2. Construct a robust histogram from a sketch.     -   a. Identify the resolution levels of dyadic intervals of the         representation.     -   b. Identify a single dyadic interval that improves the         representation, i.e., brings Ĥ_(r) closer to a robust histogram.     -   c. Add the dyadic interval identified in step b to the         intermediate representation, Ĥ_(r).     -   d. Iterate with subsequent dyadic intervals until the         representation is robust, H_(r). -   3. Construct an output histogram, H, from the sketch and the robust     histogram via a hybrid histogram H*.

The robust histogram, H_(r), is defined as a (B_(r), ε_(r)) robust approximation of A with poly (B, log N, 1/ε) B-buckets if, given any collection of X, of |X|≦B_(r) non-overlapping intervals, any histogram H′ which can be expressed as

$H^{\prime} = \left\{ \begin{matrix} {H_{r},{\left\lbrack {0,N} \right) - {\bigcup_{I \in X}I}}} \\ {{c_{I}\chi_{I}},{I \in X}} \end{matrix} \right.$ satisfies (1−ε_(r))|A−H_(r)∥≦∥A−H′∥. In other words, whenever H′ refines H_(r), by at most B intervals, H′ does not significantly improve the error. A robust histogram is not improved much if it is refined by a small number of additional buckets. While |X|≦B_(r) is small, ∪_(I∈X) I can be large, e.g., equal to [0, N).

To achieve a representation, H_(r), the current representation, H′, is improved until taking B more intervals does not improve the error significantly. Finding H_(r) is similar to finding a wavelet representation, as discussed below.

If H=H′ everywhere except on a non-overlapping set of intervals X, then

${{{A - H}} - {{A - H^{\prime}}}} = {\sum\limits_{I \in X}\left( {\left. {{\pi\left( {{A - H},I} \right)} - {{\pi\left( {{A - H^{\prime}},I} \right)}}} \right).} \right.}$ Where H is not a robust approximation of A, it can be improved by B intervals. The histogram can be improved by repeatedly identifying and subtracting off sets of large coefficients. Given a histogram H that is not robust, there exists a dyadic interval I and a parameter c such that a histogram H′, which agrees with H everywhere except I, and takes the value c on I, approximates A better than H by a factor of 1−ε_(r)/(4B_(r) log N).

Recall that a dyadic interval is of the form [i2^(j), . . . , (i+1)2^(j)), for integers i and j. There are a small number of “resolution levels” which are possible values for integer j, or the length of the interval. Dyadic intervals at a particular resolution level do not overlap. Dyadic intervals can be written as a non-overlapping union of a small number of these resolution levels. Each resolution level can be identified, removed and replaced with an estimate.

When building a robust representation, H_(r), if the current form of the representation is not robust, denoted Ĥ_(r), then some B non-overlapping intervals will improve the error by 1−ε_(r). By definition, some one interval improves the error by 1−ε_(r)/2B. That implies that some single dyadic interval improves the error by 1−ε_(r)/4B log N. So, if the representation is not already robust, a single dyadic interval can be determined that improves the representation significantly. Once that interval is removed, the process is repeated with subsequent dyadic intervals until the representation is robust, H_(r).

This robust representation, H_(r), already has good error. Specifically, (1−ε_(r))∥A−H_(opt)∥≧∥A−H_(r)∥ where H_(opt) is an optimal histogram. However, H_(r) has too many buckets from the iterative process. The next step is to obtain a desired (lesser) number of buckets given the sketch and the robust histogram, to build an output histogram, H.

To reduce the number of buckets, consider joining, whole or fractal, adjacent buckets. As buckets are being joined, the error must be monitored against a threshold error. By doing so, the error will either stay the same, or more likely, increase, if using only whole buckets. The error may stay the same, increase or decrease if fractal buckets are also combined. If the error decreases, the definition of robust is contradicted. More specially, H_(r) is robust; and by definition, robustness means that it is immune to splitting buckets, i.e., it is immune to making available partial buckets. Thus, in order to combine whole buckets, the buckets must first be divided into multiple distinct buckets. Once divided, the error will not decrease significantly.

Next it is necessary to determine where to place the first bucket boundary. There are N places where the boundary could be placed. In order to minimize the time in finding the appropriate boundary, a binary search is performed. It is important that the error increases as the bucket increases so that an accurate search can be performed. For example, a first bucket boundary is placed half way along H_(r). The error is calculated and compared to an optimal error. If the error is too large, the boundary is moved to reduce the size of the bucket, e.g., to one-quarter of H_(r). If the error is not too large, that bucket can be used, or the boundary can be moved to increase the size of the bucket, e.g., to three-quarters of H_(r). This process is repeated until a suitable boundary is determined.

Determining an optimal error for the first bucket is a standard technique known as dynamic programming, as one skilled in the art will appreciate. The optimal error, δ, is equal to ∥A−H_(opt)∥. Assume that δ is known approximately, e.g., up to a factor of 1±ε. The optimal error, δ, can be determined by “guessing” at multiples of the factor 1±ε. In other words, try δ=1; δ1+ε; δ(1ε)²; etc. The objective is to obtain H whose error is at most (1+ε)δ, i.e., ∥A−H∥≦(1+ε)δ. To do this, find a histogram on the interval [0, i) with k buckets and an error ≦l. Compute this histogram for i=1, . . . , N; for k=1, . . . , B (all buckets); and for all possible multiples of the error from 1 to δ in increments of εδ, where there is some upper bound on δ.

In reality, the error of a bucket cannot be determined. The bucket can be thought of as an interval A_(I), which is equal to A on the interval [0, i) and 0 on the interval [i, N). The error is ∥A_(I)−H_(I)∥, however the error on an interval cannot be directly calculated. In contrast, the error of the whole signal A, of an l₁ norm, can be calculated directly.

A hybrid, H*, is constructed where H* is H on the interval I and H_(r) elsewhere. With the hybrid, the error ∥H*−A∥ can be estimated. The hybrid is constructed one bucket at a time, e.g., on an increasing prefix i, from 0 to N. When i has increased to N, H* is equal to the output histogram H and has none of the robust histogram, H_(r), remaining. Thus a suitable output histogram, H, has been determined.

The following figures depict the above text in graphical form. FIG. 2 a is a representation of an exemplary stream of data transactions to be summarized by the present invention. FIG. 2 b is a representation of the aggregated stream, which yields data signal, A. FIG. 3 a is a graphical representation of the data signal A of FIG. 2 b with a robust histogram overlay. FIG. 3 b is a graphical representation of data signal A with a one-bucket output histogram overlay.

Wavelets

In addition to histograms, wavelets can also be used to summarize data signals. As noted above, wavelets are mathematical functions that divide data into different frequencies to facilitate summarizing and analyzing data.

In one embodiment, to produce a desired data summary of traffic traveling through a router, a Haar wavelet is used to represent the data. A Haar wavelet, ψ_(j,k), on [0, N) has the following characteristics:

$\Psi_{j,k} = \left\{ \begin{matrix} {{+ 2^{j\text{/}2}},\left\lbrack {{2^{- j}k},{2^{- j}\left( {k + \frac{1}{2}} \right)}} \right\rbrack} \\ {{- 2^{j\text{/}2}},\left\lbrack {{2^{- j}\left( {k + \frac{1}{2}} \right)},{2^{- j}\left( {k + 1} \right)}} \right\rbrack} \\ {0,{elsewhere}} \end{matrix} \right.$

Given the above data signal A=a[0], a[1], a[2], . . . , a[N−1], a B Haar wavelet expansion is used to approximate A by a representation R as follows:

$R = {\sum\limits_{\lambda \in A}\;{d_{\lambda}\psi_{\lambda}}}$ where d_(λ) coefficients are the inner products of A and ψ_(λ) and the index set of Λ is of size B. R_(opt) is defined as an optimal B-term representation. Given the data signal A and the B Haar wavelets, the present invention will return R, a B-term wavelet representation for A, with the following properties with regard to error, processing time and working space. 1. The error is small. The error ∥A−R∥₂ will be less than or equal to (1+ε)∥A−R_(opt)∥₂. The term ε is a user-defined error parameter. 2. The processing time is fast. The time to process will be polynomial in B and log N/ε. 3. The working space to compute the representation is small. The working space is polynomial in B and log N/ε.

In the present network example, these properties are necessary to create the representation at a router that has strict allocation of its properties and not much available processing time and working space. In addition, if the representation has a significant error from the original signal, the representation is not of much value.

FIG. 4 is a portion of the network of FIG. 1 showing the operation of the synopsis data structure. While router 412 is being used for exemplary purposes, it will be appreciated that routers 402 and 422 operate in a similar manner. Data signal 401 is received and processed as described herein by the synopsis data structure of router 412. In response to a request for a wavelet representation, wavelet coefficients and the corresponding wavelet 408 are output from the synopsis data structure. Output 408 can then be sent off to data warehouse 440, or some other central collection location, via network 430 for collection and/or further processing.

The data stream is constantly changing. Data warehouse 440 can request wavelet representations or array sketches from any or all of routers 402, 412 and 422 to then compile the dynamic data from the distributed routers.

Given the above tools, a suitable representation R of data signal A can be computed as follows.

1. Using the data array sketches, identify the relatively large wavelet coefficients in the representation, using a non-adaptive group testing method.

2. Estimate the identified large coefficients. Add to Representation R, these significant wavelet terms weighted by their coefficients. The estimation can be done using the data array sketches.

3. Iterate steps 1 and 2 with the residual representation.

The above method can be illustrated with the following example, where a three term data signal is given and a two-term representation is desired. A=4ψ₁+10ψ₂+5ψ₃. Iteration No. 1:

-   -   Step 1: Identification. The second coefficient, 10, is big.     -   Step 2: Estimation. Ten (10) is estimated as 11.     -   Step 3: Residual. Subtract R from A. R=11ψ₂. Residual         (error)=4ψ₁−1ψ₂+5ψ₃.         Iteration No. 2:     -   Step 1: Identification. The first coefficient, 4, is big.     -   Step 2: Estimation. Four (4) is estimated as 3.5.     -   Step 3: Residual. R=3.5ψ₁+11ψ₂. Residual (error)=0.5ψ₁−1ψ₂+5ψ₃.         And so forth.

With the wavelet representations, the large coefficients are identified and removed from the representation. Wavelet basis functions are orthogonal, so when one coefficient is removed, the other coefficients remain unaffected.

The present invention is described above, often with reference to routers and network data. It will be understood, however, this is exemplary. The present invention may be useful in many other contexts as would be obvious to one of ordinary skill. For example, the present invention may be implemented when it is desirable to analyze a vector sum without revealing the individual vectors that form the basis of the sum. There is known cryptographic literature for performing a vector sum protocol privately. This literature describes a technique where intermediate messages look random and give no indication of the vectors being added. To implement this technique, you need to start with a full circuit for computing the function. In other words, there is a circuit, known in the art for computing the vector sum, and cryptographic literature teaches that this circuit can be kept private by making intermediate messages needed to compute the sum, look random. This technique is costly in that N communications are required for an input vector of length N.

With the present invention, vector sums can be calculated, while maintaining the confidentiality of the underlying vectors that compose the vector sum, in an amount of time that is a logarithmic factor of the N communications. To implement the present invention, where multiple parties desire to combine their data while maintaining the confidentiality of their individual data from the other parties, each party makes an array sketch of his data. The sketches are small, in comparison to the original data. The sketches are added to yield a vector sum, which is small in comparison to the above known technique, because the inputs are smaller. Because the sketches are linear functions of the original vectors, the sketch of the vector sum is the sum of the sketches. Thus, whatever is computed from the sketch of the vector sum depends only on the vector sum. In other words, the vector sum does not depend on the initial input sketches individually, only the sum of the sketches. Confidentiality of the initial data can thus be maintained.

Although embodiments of the present invention are illustrated in the accompanying Figures and are described in this Detailed Description, it is understood that the present invention is not limited to these embodiments, but is capable of numerous arrangements, modifications, and substitutions without departing from the spirit or scope of the invention as defined in the claims. Various modifications and adaptations of the present invention will be apparent to persons skilled in the art. 

1. A method for providing an output histogram corresponding to a data signal, comprising: receiving the data signal; determining an array sketch of the data signal; constructing a robust histogram from the array sketch, wherein the constructing step comprises: identifying resolution levels of dyadic intervals of a representation of the array sketch, identifying a single dyadic interval that decreases the differences between the representation and the robust histogram, and iterating the identifying a single dyadic interval step with subsequent dyadic intervals until the representation is substantially equivalent to the robust histogram; and constructing the output histogram from the array sketch and the robust histogram via a hybrid histogram; wherein the output histogram is used for observing a traffic pattern in a network.
 2. The method of claim 1, where the determining of the array sketch step and the constructing of the output histogram step occur at different locations.
 3. The method of claim 2, where the determining of the array sketch step occurs at a router in a network and the constructing of the output histogram step occurs at a data warehouse.
 4. The method of claim 1, where all the steps are performed at a network router.
 5. The method of claim 1, wherein the array sketch is a compact synopsis data structure.
 6. The method of claim 1, wherein the data signal is dynamic.
 7. The method of claim 1, wherein in constructing the output histogram, workspace, memory space, and computation time are polynomial in data signal length N.
 8. The method of claim 1, wherein the robust histogram, H_(r), is defined as a (B_(r), ε_(r)) robust approximation of the data signal A if, given any collection of X, of |X|≦B_(r) non-overlapping intervals, any histogram H′ which can be expressed as $H^{\prime} = \left\{ \begin{matrix} {H_{r},{\left\lbrack {0,N} \right) - {Y_{I \in X}I}}} \\ {{c_{1}\chi_{1}},{I \in X}} \end{matrix} \right.$ satisfies (1−ε_(r))∥A−H_(r)∥≦∥A−H′∥, where B_(r) is a number of buckets in the robust histogram, ε_(r) is a user-defined error parameter, c is a user-defined parameter, and H′ is a current state of the robust approximation.
 9. The method of claim 8, wherein the number of buckets B_(r) is reduced to produce the output histogram H from the robust histogram H_(r) and the array sketch.
 10. The method of claim 1, wherein the hybrid histogram, H*, equals the output histogram, H, on an interval I and the robust histogram, H_(r), elsewhere.
 11. A method for providing a summary of multiple data signals, comprising: receiving a first data signal at a first location, where the first data signal is dynamic; determining a first array sketch of the first data signal; constructing a first output histogram from the first array sketch and a first robust histogram via a first hybrid histogram; receiving a second data signal at a second location, where the second data signal is dynamic and where the second location is distinct from the first location; determining a second array sketch of the second data signal; constructing a second output histogram from the second array sketch and a second robust histogram via a second hybrid histogram; and outputting the first output histogram and the second output histogram to a third location; wherein to provide the summary, workspace, memory space, and computation time are polynomial in data signal length N; and wherein the first output histogram and the second output histogram are used for observing a traffic pattern in a network.
 12. An apparatus for providing a summary of a data signal, comprising: means for receiving the data signal, where the data signal is dynamic in that the data signal may change in a positive or negative manner; means for determining an array sketch of the data signal; means for constructing a robust histogram from the array sketch, wherein the constructing step comprises: means for identifying resolution levels of dyadic intervals of a representation of the array sketch, means for identifying a single dyadic interval that decreases the differences between the representation and the robust histogram, and means for iterating the identifying a single dyadic interval step with subsequent dyadic intervals until the representation substantially equivalent to the robust histogram; and means for constructing an output histogram from the array sketch and the robust histogram via a hybrid histogram; wherein the output histogram is used for observing a traffic pattern in a network.
 13. A method for providing summaries of call detail data, comprising: receiving first call detail data at a first router, where the first call detail data is dynamic; determining a first array sketch of the first data signal; constructing a first output histogram from the first array sketch and a first robust histogram via a first hybrid histogram; receiving a second data signal at a second location, where the second data signal is dynamic and where the second location is distinct from the first location; determining a second array sketch of the second data signal; constructing a second output histogram from the second array sketch and a second robust histogram via a second hybrid histogram; and collecting the first output histogram and the second output histogram at a third location; wherein the first output histogram and the second output histogram are used for observing a traffic pattern in a network; wherein the first robust histogram is constructed from a method comprising: identifying resolution levels of dyadic intervals of a representation of the first array sketch; identifying a single dyadic interval that decreases the differences between the representation and the first robust histogram; and iterating the identifying a single dyadic interval step with subsequent dyadic intervals until the representation substantially equivalent to the first robust histogram.
 14. The method of claim 13, wherein the second robust histogram is constructed from a method comprising: identifying resolution levels of dyadic intervals of a representation of the second array sketch; identifying a single dyadic interval that decreases the differences between the representation and the second robust histogram; and iterating the identifying a single dyadic interval step with subsequent dyadic intervals until the representation substantially equivalent to the second robust histogram. 